Handle malformed percent-encoding

Closes rust-postgres#182

Author: millerjs

src/url.rs

@@ -131,8 +131,17 @@ fn decode_inner(c: &str, full_url: bool) -> DecodeResult<String> {
                             }
                         };
 
+                        let bytes_from_hex = match Vec::<u8>::from_hex(&bytes) {
+                            Ok(b) => b,
+                            _ => {
+                                return Err("Malformed input: found '%' followed by \
+                                            invalid hex  values. Character '%' must \
+                                            escaped.".to_owned())
+                            }
+                        };
+
                         // Only decode some characters if full_url:
-                        match Vec::<u8>::from_hex(&bytes).unwrap()[0] as char {
+                        match bytes_from_hex[0] as char {
                             // gen-delims:
                             ':' |
                             '/' |

tests/test.rs

@@ -938,6 +938,11 @@ fn test_get_opt_wrong_type() {
     }
 }
 
+#[test]
+fn url_unencoded_password() {
+    assert!("postgresql://username:password%1*@localhost".into_connect_params().is_err())
+}
+
 #[test]
 fn url_encoded_password() {
     let params = "postgresql://username%7b%7c:password%7b%7c@localhost".into_connect_params().unwrap();